Which versions of v11zzgbqvirfx are malicious?

The following RubyGems versions of v11zzgbqvirfx are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate v11zzgbqvirfx if I installed it?

Remove v11zzgbqvirfx from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed v11zzgbqvirfx — how do I know if it already compromised me?

If v11zzgbqvirfx was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is v11zzgbqvirfx part of a known attack campaign?

Yes — v11zzgbqvirfx is associated with the RLMA-2026-03725, RLUA-2026-09652 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find v11zzgbqvirfx across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for v11zzgbqvirfx (version 0.0.1).

Malicious package

v11zzgbqvirfxRubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

v11zzgbqvirfx is a confirmed malicious RubyGems package (MAL-2026-9074) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in v11zzgbqvirfx (RubyGems)

MAL-2026-9074

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall v11zzgbqvirfx

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

16267a6d8df6f20716454713c1bbac3fa3d65f13b232f101bcd6f9a02e848547

90af93ebd285e151f3ceb17b51959e9958ea359b6ac11a3d67b07efad3753f7b

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for v11zzgbqvirfx (version 0.0.1).
If you installed it — respond
Remove v11zzgbqvirfx from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If v11zzgbqvirfx was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. v11zzgbqvirfx on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-03725RLUA-2026-09652

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks v11zzgbqvirfx-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database